{"id":"CVE-2026-126468","kind":"vulnerability","aliases":["CVE-2026-126468"],"related":[],"title":"OpenEMR: low-privilege users can export patient data and send reminders","description":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing.","summary":"OpenEMR before 8.5.0 lets any logged-in user with low privileges open report, reminder and batch reminder endpoints that skip access checks. An attacker can export patient health information and trigger unauthorized reminders.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","phi","self-hosted"],"not_affected_if":["version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version against the fixed release in the product data (`8.5.0`).\n- Review the OpenEMR deployment for user accounts with low-privilege roles that can log in.","fix":"- OpenEMR: `8.5.0`","status":"open","published_at":"2026-11-13T10:17:55+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:48:53+00:00","updated_at":"2026-11-13T10:48:53+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:48:53Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: `8.5.0`","reach":"network","title":"OpenEMR: low-privilege users can export patient data and send reminders","impact":"high","summary":"OpenEMR before 8.5.0 lets any logged-in user with low privileges open report, reminder and batch reminder endpoints that skip access checks. An attacker can export patient health information and trigger unauthorized reminders.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","phi"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Patient health records exported and unauthorized reminders sent by low-privilege users","analyst_note":"Confirm the exact affected version range and whether the vendor advisory on github.com lists any workaround besides upgrading to 8.5.0.","how_to_check":"- Check the installed OpenEMR version against the fixed release in the product data (`8.5.0`).\n- Review the OpenEMR deployment for user accounts with low-privilege roles that can log in.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-8.5.0-or-later"],"who_is_affected":"Any OpenEMR instance before 8.5.0 where users hold authenticated low-privilege accounts is exposed, since the flawed endpoints lack the ACL check that the rest of the application applies. Instances that are upgraded to 8.5.0 or later, or where only fully trusted staff have accounts, are less exposed. Sources do not state configuration details beyond the version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000755,"input_tokens":4651,"output_tokens":579,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126468':15A,18A '-2026':14A,17A '8.5.0':28B,62C 'access':47B,77C 'aclcheckcor':87C 'aclmain':86C 'allow':69C 'amc_full_report.php':93C 'attack':50B,89C 'authent':71C 'author':66C 'batch':42B,82C,107C 'batch_reminders.php':96C 'check':48B,88C 'contain':63C 'cve':13A,16A 'data':9A 'date':79C 'dated_reminders_add.php':94C 'direct':97C 'endpoint':44B,84C 'export':7A,52B,99C 'health':54B 'healthcar':19B 'host':25B 'inform':55B 'lack':85C 'let':29B 'log':32B 'logged-in':31B 'low':3A,36B,73C 'low-privileg':2A,72C 'miss':65C 'open':38B 'openemr':1A,20B,26B,60C 'patient':8A,53B,100C 'patient_list.php':92C 'phi':22B,101C 'privileg':4A,37B,74C 'process':109C 'remind':12A,40B,43B,59B,80C,83C,104C,108C 'report':39B,78C 'request':91C 'self':24B 'self-host':23B 'send':11A,102C 'skip':46B 'trigger':57B,106C 'unauthor':58B,103C 'user':5A,34B,75C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Any OpenEMR instance before 8.5.0 where users hold authenticated low-privilege accounts is exposed, since the flawed endpoints lack the ACL check that the rest of the application applies. Instances that are upgraded to 8.5.0 or later, or where only fully trusted staff have accounts, are less exposed. Sources do not state configuration details beyond the version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","other","phi","selfhosted"],"campaign_type":null,"search_a":"'-126468':15A,18A '-2026':14A,17A 'cve':13A,16A 'data':9A 'export':7A 'low':3A 'low-privileg':2A 'openemr':1A 'patient':8A 'privileg':4A 'remind':12A 'send':11A 'user':5A","search_b":"'8.5.0':28B 'access':47B 'attack':50B 'batch':42B 'check':48B 'endpoint':44B 'export':52B 'health':54B 'healthcar':19B 'host':25B 'inform':55B 'let':29B 'log':32B 'logged-in':31B 'low':36B 'open':38B 'openemr':20B,26B 'patient':53B 'phi':22B 'privileg':37B 'remind':40B,43B,59B 'report':39B 'self':24B 'self-host':23B 'skip':46B 'trigger':57B 'unauthor':58B 'user':34B","search_c":"'8.5.0':62C 'access':77C 'aclcheckcor':87C 'aclmain':86C 'allow':69C 'amc_full_report.php':93C 'attack':89C 'authent':71C 'author':66C 'batch':82C,107C 'batch_reminders.php':96C 'check':88C 'contain':63C 'date':79C 'dated_reminders_add.php':94C 'direct':97C 'endpoint':84C 'export':99C 'lack':85C 'low':73C 'low-privileg':72C 'miss':65C 'openemr':60C 'patient':100C 'patient_list.php':92C 'phi':101C 'privileg':74C 'process':109C 'remind':80C,83C,104C,108C 'report':78C 'request':91C 'send':102C 'trigger':106C 'unauthor':103C 'user':75C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T22:50:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126468","severity":null,"published_at":"2026-11-13T10:17:55+00:00","modified_at":"2026-11-13T10:17:55+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145179,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-6h9j-m5w9-8938","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T22:50:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145180,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-on-reports-and-reminder-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}